1.\" $NetBSD: fstat.1,v 1.25 2009/01/04 17:19:39 wiz Exp $ 2.\" 3.\" Copyright (c) 1987, 1991, 1993 4.\" The Regents of the University of California. All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 2. Redistributions in binary form must reproduce the above copyright 12.\" notice, this list of conditions and the following disclaimer in the 13.\" documentation and/or other materials provided with the distribution. 14.\" 3. Neither the name of the University nor the names of its contributors 15.\" may be used to endorse or promote products derived from this software 16.\" without specific prior written permission. 17.\" 18.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 19.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 22.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 24.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 25.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 26.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 27.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 28.\" SUCH DAMAGE. 29.\" 30.\" from: @(#)fstat.1 8.3 (Berkeley) 2/25/94 31.\" $NetBSD: fstat.1,v 1.25 2009/01/04 17:19:39 wiz Exp $ 32.\" 33.Dd January 4, 2009 34.Dt FSTAT 1 35.Os 36.Sh NAME 37.Nm fstat 38.Nd display status of open files 39.Sh SYNOPSIS 40.Nm 41.Op Fl fnv 42.Op Fl M Ar core 43.Op Fl N Ar system 44.Op Fl p Ar pid 45.Op Fl u Ar user 46.Op Ar 47.Sh DESCRIPTION 48.Nm 49identifies open files. 50A file is considered open by a process if it was explicitly opened, 51is the working directory, root directory, active pure text, or kernel 52trace file for that process. 53If no options are specified, 54.Nm 55reports on all open files in the system. 56.Pp 57Options: 58.Bl -tag -width Ds 59.It Fl f 60Restrict examination to files open in the same filesystems as 61the named file arguments, or to the filesystem containing the 62current directory if there are no additional filename arguments. 63For example, to find all files open in the filesystem where the 64directory 65.Pa /usr/src 66resides, type 67.Dq Li fstat -f /usr/src . 68.It Fl M 69Extract values associated with the name list from the specified core 70instead of the default 71.Pa /dev/kmem . 72.It Fl N 73Extract the name list from the specified system instead of the default 74.Pa /netbsd . 75.It Fl n 76Numerical format. 77Print the device number (maj,min) of the filesystem 78the file resides in rather than the mount point name; for special 79files, print the 80device number that the special device refers to rather than the filename 81in 82.Pa /dev ; 83and print the mode of the file in octal instead of symbolic form. 84.It Fl p 85Report all files open by the specified process. 86.It Fl u 87Report all files open by the specified user. 88.It Fl v 89Verbose mode. 90Print error messages upon failures to locate particular 91system data structures rather than silently ignoring them. 92Most of 93these data structures are dynamically created or deleted and it is 94possible for them to disappear while 95.Nm 96is running. 97This 98is normal and unavoidable since the rest of the system is running while 99.Nm 100itself is running. 101.It Ar 102Restrict reports to the specified files. 103.El 104.Pp 105The following fields are printed: 106.Bl -tag -width MOUNT 107.It Li USER 108The username of the owner of the process (effective UID). 109.It Li CMD 110The command name of the process. 111.It Li PID 112The process ID. 113.It Li FD 114The file number in the per-process open file table or one of the following 115special names: 116.Pp 117.Bl -tag -width MOUNT -offset indent -compact 118.It Li text 119pure text inode 120.It Li wd 121current working directory 122.It Li root 123root inode 124.It Li tr 125kernel trace file 126.El 127.Pp 128If the file number is followed by an asterisk 129.Pq Dq * , 130the file is not an inode, but rather a socket, 131.Tn FIFO , 132or there is an error. 133In this case the remainder of the line doesn't 134correspond to the remaining headers -- the format of the line 135is described later under 136.Sx SOCKETS . 137.It Li MOUNT 138If the 139.Fl n 140flag wasn't specified, this header is present and is the 141pathname that the filesystem the file resides in is mounted on. 142.It Li DEV 143If the 144.Fl n 145flag is specified, this header is present and is the 146major/minor number of the device that this file resides in. 147.It Li INUM 148The inode number of the file. 149.It Li MODE 150The mode of the file. 151If the 152.Fl n 153flag isn't specified, the mode is printed 154using a symbolic format (see 155.Xr strmode 3 ) ; 156otherwise, the mode is printed 157as an octal number. 158.It Li SZ\&|DV 159If the file is not a character or block special file, prints the size of 160the file in bytes. 161Otherwise, if the 162.Fl n 163flag is not specified, prints 164the name of the special file as located in 165.Pa /dev . 166If that cannot be 167located, or the 168.Fl n 169flag is specified, prints the major/minor device 170number that the special device refers to. 171.It Li R/W 172This column describes the access mode that the file allows. 173The letter 174.Dq r 175indicates open for reading; 176the letter 177.Dq w 178indicates open for writing. 179This field is useful when trying to find the processes that are 180preventing a filesystem from being downgraded to read-only. 181.It Li NAME 182If filename arguments are specified and the 183.Fl f 184flag is not, then 185this field is present and is the name associated with the given file. 186Normally the name cannot be determined since there is no mapping 187from an open file back to the directory entry that was used to open 188that file. 189Also, since different directory entries may reference 190the same file (via 191.Xr ln 1 ) , 192the name printed may not be the actual 193name that the process originally used to open that file. 194.El 195.Sh SOCKETS 196The formatting of open sockets depends on the protocol domain. 197In all cases the first field is the domain name and 198the second field is the socket type (stream, dgram, etc.). 199The remaining fields are protocol dependent. 200For TCP, it is the address of the tcpcb, and for UDP, the inpcb (socket pcb). 201For 202.Ux 203domain sockets, its the address of the socket pcb and the address 204of the connected pcb (if connected). 205Otherwise the protocol number and address of the socket itself are printed. 206The attempt is to make enough information available to 207permit further analysis without duplicating 208.Xr netstat 1 . 209.Pp 210For example, the addresses mentioned above are the addresses which the 211.Dq Li netstat -A 212command would print for TCP, UDP, and 213.Ux 214domain. 215Note that since pipes are implemented using sockets, a pipe appears as a 216connected 217.Ux 218domain stream socket. 219A unidirectional 220.Ux 221domain socket indicates the direction of flow with an arrow 222.Po 223.Dq \*[Lt]- 224or 225.Dq -\*[Gt] 226.Pc , 227and a full duplex socket shows a double arrow 228.Pq Dq \*[Lt]-\*[Gt] . 229.Pp 230For internet sockets 231.Nm fstat 232also attempts to print the internet address and port for the 233local end of a connection. 234If the socket is connected, it also prints the remote internet address 235and port. 236An asterisk 237.Pq Dq * 238is used to indicate an INADDR_ANY binding. 239.Sh SEE ALSO 240.Xr netstat 1 , 241.Xr nfsstat 1 , 242.Xr ps 1 , 243.Xr sockstat 1 , 244.Xr systat 1 , 245.Xr vmstat 1 , 246.Xr iostat 8 , 247.Xr pstat 8 248.Sh HISTORY 249The 250.Nm 251command appeared in 252.Bx 4.3 tahoe . 253.Sh BUGS 254Since 255.Nm 256takes a snapshot of the system, it is only correct for a very short period 257of time. 258.Pp 259Moreover, because DNS resolution and YP lookups cause many file 260descriptor changes, 261.Nm 262does not attempt to translate the internet address and port numbers into 263symbolic names. 264